What is the CVSS score of CVE-2025-52789?

CVE-2025-52789 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of George Lewe Lewe ChordPress are affected by CVE-2025-52789?

A stored cross-site scripting vulnerability in George Lewe ChordPress (versions through 3.9.7) allows attackers to inject malicious code that executes in users' browsers, potentially compromising…

How to fix or mitigate CVE-2025-52789?

Within 24 hours: Inventory all instances of ChordPress and assess exposure scope; disable the plugin if non-critical and document justification if business-critical. Within 7 days: Implement Web Application Firewall (WAF) rules to detect and block stored XSS payloads; restrict plugin access to trusted administrators only via role-based controls. Within 30 days: Monitor vendor communications for security updates; evaluate alternative chord/music plugins with active security maintenance; plan migration timeline if patch remains unavailable.

George Lewe Lewe ChordPress CVE-2025-52789

EUVD-2025-28463 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-06-20 audit@patchstack.com

CSRF XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-28463

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

CVE Published

Jun 20, 2025 - 15:15 nvd

HIGH 7.1

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in George Lewe Lewe ChordPress allows Stored XSS. This issue affects Lewe ChordPress: from n/a through 3.9.7.

AnalysisAI

A cross-site scripting vulnerability in George Lewe Lewe ChordPress allows Stored XSS (CVSS 7.1). High severity vulnerability requiring prompt remediation.